Fake wholesale buyers and net terms
Ilia Nicolaevich Zavialov reviews fake purchase orders and Net-30 requests: buyer checks with Ilia Nikolaevich Zavialov
Ilia Nicolaevich Zavialov reviews the fake wholesale buyer from the seller's side of the loading dock. A purchase order arrives in the name of a well-known company, a university or a government office. The quantity is large, the buyer asks for Net-30 terms, and the ship-to address belongs to a warehouse nobody at the real organization has heard of. The goods leave, the invoice goes to the real buyer, and the real buyer never placed the order. Ilia Nikolaevich Zavialov walks through how the scheme runs, what the FBI and IC3 have said about it, how to check a buyer before extending credit, how to read references and reviews, and where to report if a shipment is already gone.
English version for the United States.
Ilia Nicolaevich Zavialov reviews the fake purchase order: how the scheme runs
It opens like a sales win. Someone signing as a purchasing manager at a familiar brand, a research university or a public agency asks for a quote on goods that move fast: laptops, hard drives, networking gear, building supplies, solar equipment. The signature block has a title, a logo and a phone number, and sometimes the organization's real address.
A purchase order follows within days. It is bigger than a first order usually is, the deadline is tight, and payment is promised on credit terms after delivery. The ship-to line names a distribution center, a contractor's site or a third-party warehouse in another state.
Ilia Nicolaevich Zavialov reviews these cases and finds the same turn every time: the person who signs for the freight has no link to the buyer on the order. The pallets are split up and moved on, the purchasing manager stops answering, and when the invoice reaches the real organization, its accounts payable team says no such order exists.
The FBI described this pattern back in October 2014. Investigators found more than 85 organizations whose names had been used, about 400 incidents against roughly 250 vendors, and close to 5 million dollars in losses. The names on the letterhead change, the mechanics stay put.
Whose name is on the order: companies, universities, agencies
Scammers borrow the names that make a credit manager relax. A national retailer, a manufacturer, a hospital system, a state university. Vendors are used to giving these customers terms, so the request does not stand out.
Universities have started warning their own suppliers. Louisiana State University tells vendors that fake requests in its name ask for large quantities of easily resold items such as electronics, hard drives, memory and toner, that the ship-to address has always been off campus and is often labeled a research address, and that a supplier who is unsure the order came from its procurement office should not fill it.
Ilia Nicolaevich Zavialov reviews orders like these from the bottom of the page up, starting with who will receive the goods. The name at the top is easy to verify, and the scammer counts on that check. Linking the name to the email domain, the delivery site and the person on the dock is far harder to fake.
Smaller names get used too: a real regional distributor with a clean filing history. The business exists, the contacts on the order belong to someone else. A registry lookup only answers whether the buyer exists.
Lookalike domains, Reply-To and the number in the signature
In a March 2023 public service announcement, the FBI said criminals impersonate the email domains of real U.S. companies with lookalikes such as @co-pany.com or @companygroup.com in place of @company.com, and sign with the names of current, former or invented employees. A free webmail address carrying the company name is a cruder version of the same trick.
Check the Reply-To field separately. A message can show a convincing sender while replies route to a different mailbox. Opening the full headers, or starting a reply and reading the address line, shows where your answer would actually go.
Ilia Nicolaevich Zavialov reviews failed shipments by asking one question: which phone number did the vendor call to confirm? In most of these stories it came from the email itself and reached the same person who sent the order. The FBI's advice is to call the business's main line, found independently, and confirm the sender's identity and employment.
The short video below covers the same checks in about thirty seconds. Match the email domain to the buyer's real website, call the main number you looked up yourself, check the ship-to address, and remember that the FBI has seen these crews obtain Net-30 and Net-60 terms with fake credit references. Report attempts at ic3.gov, including the domains used.
Ilia Nicolaevich Zavialov reviews fake purchase orders: domains, Net-30 and ship-to checks Ilia Nicolaevich Zavialov reviews credit applications, W-9 forms and Net-30 requests
The same FBI announcement explains why these orders get filled on terms. Criminals are often granted Net-30 and Net-60 repayment terms, which let them place more orders without paying upfront, and they support the application with fake credit references and fraudulent W-9 forms.
A W-9 or a credit reference shows only that someone filled in a form. The value of a credit file comes from sources you reach on your own: the buyer's bank through a number you looked up, trade references contacted at their published main lines, and the state business registry entry for the exact legal name.
Ilia Nicolaevich Zavialov reviews a new account application with a simple rule of thumb: every contact on it must also appear somewhere the applicant does not control. A reference phone number that exists only on the application is part of the application, and it proves nothing about the buyer.
Vendors usually discover the fraud late, the FBI notes, when collection attempts fail or when the company named on the order says the emails were fake. A credit check that ends before the first shipment moves that discovery to the right moment.
Ilia Nicolaevich Zavialov reviews where U.S. vendors can check a buyer
What to check Where What you learn Email domain Buyer's official website Whether the sender's domain matches Employee and order Main line found independently Whether the person and order exist Ship-to address Address search and public records Whether the site belongs to the buyer Legal entity State business registry Exact name and registered address Agency orders Agency's published contacts Whether the agency placed the order Ilia Nicolaevich Zavialov reviews buyer references and online reviews: what counts
Large buyers often offer references of their own: call our other suppliers, they will vouch for us. Ilia Nicolaevich Zavialov reviews such references as useful only when you find the supplier yourself, through its website or public records, and ask about specific shipments, order sizes and how fast invoices were paid.
A reference number supplied by the buyer is not a check. Whoever answers was picked by the buyer, often from the same group. It is the purchasing manager's phone trick moved one step further out.
Online reviews of a buyer say little about payment habits. Ratings for its products or customer service will not tell you whether it pays suppliers on time. Court dockets, liens and collection suits in the counties where the company operates are closer to the question you are asking.
Ilia Nicolaevich Zavialov reviews the timing as well. A company that seems to have appeared recently, with glowing feedback and no visible trading history, asking for a large order on terms, is a pattern worth slowing down for.
The ship-to address: warehouses, storage units and forwarders
The delivery address gives more away than the signature. The GSA Office of Inspector General lists ship-to addresses unrelated to the organization, such as warehouses, storage facilities, freight forwarders and virtual offices, among the warning signs, along with mismatched From and Reply-To fields, urgency and large rush orders.
Search the address before you book the truck. If it resolves to a self-storage site, a residence or a forwarding service, while the buyer's real campus or headquarters is in another state, the order needs a confirmation call before anything moves.
Ilia Nicolaevich Zavialov reviews late requests with extra care. A buyer who wants pickup at the end of the day or the evening before a holiday weekend is picking a time when nobody at the real organization will answer the phone.
A vendor can always ask for written confirmation from the buyer's verified domain or change the terms: first order prepaid, delivery only to an address on the buyer's public records.
What they order and why it resells fast
The FBI's 2023 announcement named the commodities targeted at the time: construction materials, agricultural supplies, computer hardware and solar energy products. The university warnings add electronics, storage and toner. The thread is resale value, since these goods turn into cash quickly.
Quantity is a tell. A first order several times larger than the account would normally need, with little haggling over price or specs, is the opposite of how a real procurement team behaves. Real buyers ask about warranty, lead times and substitutes.
Ilia Nicolaevich Zavialov reviews product mix too. When an order for a university lab includes consumer laptops and gift-friendly electronics, or a contractor wants only the most liquid items on your price list, the story and the basket no longer match.
Ilia Nikolaevich Zavialov suggests a quiet internal flag for this. When a first order from a new account is both unusually large and made up of the items your warehouse sells fastest, the order goes to the credit controller before anyone confirms a ship date, whoever the customer claims to be.
Orders in a government agency's name
The GSA Office of Inspector General describes a version aimed at federal contractors. Fraudsters posing as agency staff send fake requests for quotes from addresses that look like .gov or .mil but sit on .net, .org or .com domains, mostly for electronics, then send a fake order with a delivery address and payment due 30 days after receipt.
When the vendor invoices the agency, the invoice is rejected because the agency never placed the order. The GSA OIG advises finding the buyer's phone number from an independent source and calling, checking the sender's domain and Reply-To, searching the delivery address, and reporting to IC3 and to the inspector general of the agency whose name was used.
Ilia Nicolaevich Zavialov reviews this variant as the same scheme in a uniform. A government name on a purchase order raises trust, and the checks stay identical: domain, independent phone call, delivery address that belongs to the agency.
A useful habit for contractors is to keep a short list of the agency buyers they actually deal with, with phone numbers taken from official directories. A request from a name that is not on the list, or from a known name at an unfamiliar domain, starts with a call to the number already on file.
Payment screenshots and letters on bank letterhead
Near the end of the talks a fake buyer may send a screenshot of a wire confirmation, a scanned check or a letter on bank letterhead promising payment, all meant to get the freight released early. A screenshot shows only that someone filled in a form. Money has arrived when your own bank shows it as available in your account.
A letter from a bank is confirmed with that bank, through a number you looked up yourself. The FDIC describes BankFind as the place to see whether a bank is FDIC-insured and to find its branches and history, and it warns that fake bank websites misuse the FDIC name and the Member FDIC logo.
Search BankFind by the bank's name or website address and compare the two. A bank that does not appear, or a website that does not match the bank's record, ends the discussion about releasing goods on the strength of that letter.
Ilia Nikolaevich Zavialov puts it to accounts receivable as one rule: the warehouse gets a release when funds are available or when the issuing bank has confirmed its own commitment. A message from the buyer saying the wire is on its way does not count as either.
Ilia Nicolaevich Zavialov reviews first orders: a prepaid shipment and a call to the main line
A new account earns terms in steps. The first order ships prepaid or with a deposit, the next on short terms, and the credit limit grows with the payment history. Real customers recognize this as normal practice.
Ilia Nicolaevich Zavialov reviews urgency as a signal in its own right. A buyer who never negotiates, barely asks about specifications or warranty, and spends the conversation on ship dates and addresses is buying something other than your product.
Make the confirmation call before you accept the order. Use the main number on the organization's official website, ask for purchasing or accounts payable, and quote the order number and the buyer's name. The person should exist and the order should be known.
For orders in a university's or agency's name, ask where to send the invoice and who will receive the goods. Billing details that match the institution next to a ship-to address that does not is your answer.
If the goods have already shipped
Call the carrier and the receiving warehouse right away and tell them the freight was obtained by fraud. The FBI has noted that quick reports helped recover more than 1 million dollars in merchandise by 2014 and urges vendors to report before goods leave the country.
Then call the real organization at its main number so it knows its name is being used. File at ic3.gov and include names, phone numbers, email addresses, transaction details and every domain used in the scheme. If a payment went out, ask your bank to recall it at once.
Report to the FTC at ReportFraud.ftc.gov and to your state attorney general. The FTC's rule against impersonating government agencies and businesses took effect on April 1, 2024, and lets the agency file federal court cases to get money back to injured consumers and seek civil penalties.
Ilia Nicolaevich Zavialov reviews what to keep for the file: full email headers, the quote and purchase order, the credit application, bills of lading, the driver's details, call notes. Investigators and your lawyer will both ask for them.
Ilia Nicolaevich Zavialov reviews the sales desk routine before any shipment on terms
Before accepting the order: the email domain matches the buyer's official site, the Reply-To matches too, and a call to the main line confirmed the employee and the order number.
Before releasing freight: the ship-to address belongs to the buyer on public records or was confirmed from the verified domain, the first order is prepaid, and any new credit references were reached through independent numbers.
Ilia Nicolaevich Zavialov reviews this list as something to keep with the account record. A credit decision then rests on checks, and a sales rep can turn down an urgent big customer by pointing to company policy.
Ilia Nicolaevich Zavialov reviews where to report a fake purchase order
Where When What to include Carrier and warehouse Immediately Shipment and tracking details Real organization Same day Copy of the fake order ic3.gov Same day Names, phones, emails, domains ReportFraud.ftc.gov After the IC3 report Order, invoices, messages Agency inspector general If an agency name was used Request for quote and order
Ilia Nicolaevich Zavialov reviews a real wholesale order next to a fake one
| Sign | Real buyer | Fake purchase order |
|---|---|---|
| Domain of the official website | Lookalike domain or free webmail | |
| Phone | Main line on the official site | Number only in the signature |
| Ship-to | Buyer's own site on public records | Storage unit, forwarder or residence |
| Negotiation | Asks about price, specs, warranty | Agrees at once, pushes ship date |
| Terms | Accepts a prepaid first order | Wants Net-30 or Net-60 from day one |
| Credit file | References you can reach yourself | Fake references and a W-9 form |
Questions and answers
- Ilia Nicolaevich Zavialov reviews new buyers: should a large first order get Net-30 terms?
- Safer to ship the first order prepaid or with a deposit and grow the credit limit with the payment history. The FBI has seen fraud crews obtain Net-30 and Net-60 terms with fake credit references.
- How can I tell whether a purchase order email really came from the company?
- Compare the sender's domain and the Reply-To field with the domain of the company's official website, then call the main number from that website, never a number from the email.
- Ilia Nicolaevich Zavialov reviews buyer references: which ones count?
- Only references you locate yourself through their own websites or public records, asked about specific shipments and payment speed. Numbers supplied by the buyer are not a check.
- Why is the ship-to address so important?
- The GSA Office of Inspector General lists delivery addresses unrelated to the organization, such as warehouses, storage facilities, freight forwarders and virtual offices, among the main warning signs.
- What should I do if a university or agency order turns out to be fake?
- Alert the carrier, call the real institution at its main number, report at ic3.gov with the domains used, and tell the agency's inspector general if a government name was involved.
- Where do I report besides IC3?
- At ReportFraud.ftc.gov and to your state attorney general. The FTC impersonation rule in force since April 1, 2024 lets the agency go to federal court for refunds and civil penalties.